Received: by 2002:a05:6a10:f347:0:0:0:0 with SMTP id d7csp13960382pxu; Mon, 4 Jan 2021 09:03:01 -0800 (PST) X-Google-Smtp-Source: ABdhPJya/YyXEyPH/UN1pSqeaykDtEUb30xV7LpWOG/qlB2sZYazYqPv0s9HXoKuEWTNkndOJdQt X-Received: by 2002:a17:906:b307:: with SMTP id n7mr66348355ejz.102.1609779781354; Mon, 04 Jan 2021 09:03:01 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1609779781; cv=none; d=google.com; s=arc-20160816; b=cRodHhEhb9AMdc+yszbFwbHeNhC62c/ApRS0m4Px/opYIjGCS6/1ha1HRFk0En6HyK /mbwXbxRKZRIhVCHskD/CBfAZt3++16+9Jyo6GU5+B4l7nDpzBRSRvUbvSuYz0lP97nv +Xa10eAg4AKHrgFewCYvhL6rC0rWnTRcVui6LkWrkwIoD2EQsjDbzGCbkyS9vdZL1/z2 WOCXUnT3W10IbQp32YbivCRx9ZMGQsfbgHdIBdXsdiBh7seVLcA1WLcKYOqobNMcZUrN dWbAotTXiUFoUXZqUqx7JKigcUdPT5V0LAQ7XfvaZbJCaRoCgTG5ZztT3kGT8T31A0i1 /klQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=aTr0fxtUMzq/ay1/A3j5LUFDFlLEv8ikVz/8nXUfej0=; b=ZQCjvYqcloV+LK9mrIpQI9eOySwSExYZg7NjqJuhhSjKUPsE/2GIqnaaSG6NfE0Wml m6m9hbzHWxH1X4MHgneu2j1Xi1Y+rL0yNUW4ttUGVTcFhmBWUuUTI/HvknIpgVKpt3Tk fp+CjDsfO/Rc7dC5HukbxuvMaHK7cq8IngpOuwncVIa8oL2j0/nkpX2KnVqZeqGz/LCp oqSO0it6Db3JdItla7mrD/91oBlqo/qH1agSOcmuqKzcmtWzi5A3vKiXFG5qKmAEeSFZ 1/b8JytAPFmncc6x/qQt8UMOA9kdUGrR7UuMeg3znzry8Qd9UlugS0+mx8pAYeQzGgxs omug== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=dWyJNUgr; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id a17si32412441edn.146.2021.01.04.09.02.38; Mon, 04 Jan 2021 09:03:01 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=dWyJNUgr; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729507AbhADQLZ (ORCPT + 99 others); Mon, 4 Jan 2021 11:11:25 -0500 Received: from mail.kernel.org ([198.145.29.99]:37218 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728253AbhADQAO (ORCPT ); Mon, 4 Jan 2021 11:00:14 -0500 Received: by mail.kernel.org (Postfix) with ESMTPSA id A7CFF22573; Mon, 4 Jan 2021 15:59:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1609775957; bh=mf2OZCsr1hT4C44vU3RJEfQi0oH2d53fQjELBwfXQUE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=dWyJNUgrLGYUqGGKsnv0DsZeEKmYudJq6Q9Jx5Ce9qjJX41Fr0TxszBKgyH8fwlvi 5ta9i+vUiIXl2F5hqxWEXVBhgezuAAtORflw+eDdDZaRoiHXqKXJYYxsakGd0yrfBQ ePpBaYo9iatFrdFtK7dh+Z8cTcWPEWNo6d9meWxw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+a79e17c39564bedf0930@syzkaller.appspotmail.com, Anant Thazhemadam Subject: [PATCH 4.19 23/35] misc: vmw_vmci: fix kernel info-leak by initializing dbells in vmci_ctx_get_chkpt_doorbells() Date: Mon, 4 Jan 2021 16:57:26 +0100 Message-Id: <20210104155704.537226842@linuxfoundation.org> X-Mailer: git-send-email 2.30.0 In-Reply-To: <20210104155703.375788488@linuxfoundation.org> References: <20210104155703.375788488@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Anant Thazhemadam commit 31dcb6c30a26d32650ce134820f27de3c675a45a upstream. A kernel-infoleak was reported by syzbot, which was caused because dbells was left uninitialized. Using kzalloc() instead of kmalloc() fixes this issue. Reported-by: syzbot+a79e17c39564bedf0930@syzkaller.appspotmail.com Tested-by: syzbot+a79e17c39564bedf0930@syzkaller.appspotmail.com Signed-off-by: Anant Thazhemadam Link: https://lore.kernel.org/r/20201122224534.333471-1-anant.thazhemadam@gmail.com Signed-off-by: Greg Kroah-Hartman --- drivers/misc/vmw_vmci/vmci_context.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/misc/vmw_vmci/vmci_context.c +++ b/drivers/misc/vmw_vmci/vmci_context.c @@ -751,7 +751,7 @@ static int vmci_ctx_get_chkpt_doorbells( return VMCI_ERROR_MORE_DATA; } - dbells = kmalloc(data_size, GFP_ATOMIC); + dbells = kzalloc(data_size, GFP_ATOMIC); if (!dbells) return VMCI_ERROR_NO_MEM;